linux-stable.git/net/bluetooth, branch v3.4.22

Bluetooth: Fix using uninitialized option in RFCMode

2012-12-03T19:46:36+00:00

commit 8f321f853ea33330c7141977cd34804476e2e07e upstream.

If remote device sends bogus RFC option with invalid length,
undefined options values are used. Fix this by using defaults when
remote misbehaves.

This also fixes the following warning reported by gcc 4.7.0:

net/bluetooth/l2cap_core.c: In function 'l2cap_config_rsp':
net/bluetooth/l2cap_core.c:3302:13: warning: 'rfc.max_pdu_size' may be used uninitialized in this function [-Wmaybe-uninitialized]
net/bluetooth/l2cap_core.c:3266:24: note: 'rfc.max_pdu_size' was declared here
net/bluetooth/l2cap_core.c:3298:25: warning: 'rfc.monitor_timeout' may be used uninitialized in this function [-Wmaybe-uninitialized]
net/bluetooth/l2cap_core.c:3266:24: note: 'rfc.monitor_timeout' was declared here
net/bluetooth/l2cap_core.c:3297:25: warning: 'rfc.retrans_timeout' may be used uninitialized in this function [-Wmaybe-uninitialized]
net/bluetooth/l2cap_core.c:3266:24: note: 'rfc.retrans_timeout' was declared here
net/bluetooth/l2cap_core.c:3295:2: warning: 'rfc.mode' may be used uninitialized in this function [-Wmaybe-uninitialized]
net/bluetooth/l2cap_core.c:3266:24: note: 'rfc.mode' was declared here

Signed-off-by: Szymon Janc 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: SMP: Fix setting unknown auth_req bits

2012-10-31T17:03:02+00:00

commit 065a13e2cc665f6547dc7e8a9d6b6565badf940a upstream.

When sending a pairing request or response we should not just blindly
copy the value that the remote device sent. Instead we should at least
make sure to mask out any unknown bits. This is particularly critical
from the upcoming LE Secure Connections feature perspective as
incorrectly indicating support for it (by copying the remote value)
would cause a failure to pair with devices that support it.

Signed-off-by: Johan Hedberg 
Acked-by: Marcel Holtmann 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix sending a HCI Authorization Request over LE links

2012-10-02T17:30:34+00:00

commit d8343f125710fb596f7a88cd756679f14f4e77b9 upstream.

In the case that the link is already in the connected state and a
Pairing request arrives from the mgmt interface, hci_conn_security()
would be called but it was not considering LE links.

Reported-by: João Paulo Rechi Vita 
Signed-off-by: Vinicius Costa Gomes 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Change signature of smp_conn_security()

2012-10-02T17:30:34+00:00

commit cc110922da7e902b62d18641a370fec01a9fa794 upstream.

To make it clear that it may be called from contexts that may not have
any knowledge of L2CAP, we change the connection parameter, to receive
a hci_conn.

This also makes it clear that it is checking the security of the link.

Signed-off-by: Vinicius Costa Gomes 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix use-after-free bug in SMP

2012-10-02T17:30:34+00:00

commit 61a0cfb008f57ecf7eb28ee762952fb42dc15d15 upstream.

If SMP fails, we should always cancel security_timer delayed work.
Otherwise, security_timer function may run after l2cap_conn object
has been freed.

This patch fixes the following warning reported by ODEBUG:

WARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d()
Hardware name: Bochs
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x27
Modules linked in: btusb bluetooth
Pid: 440, comm: kworker/u:2 Not tainted 3.5.0-rc1+ #4
Call Trace:
 [] ? free_obj_work+0x4a/0x7f
 [] warn_slowpath_common+0x7e/0x97
 [] warn_slowpath_fmt+0x41/0x43
 [] debug_print_object+0x7c/0x8d
 [] ? __queue_work+0x241/0x241
 [] debug_check_no_obj_freed+0x92/0x159
 [] slab_free_hook+0x6f/0x77
 [] ? l2cap_conn_del+0x148/0x157 [bluetooth]
 [] kfree+0x59/0xac
 [] l2cap_conn_del+0x148/0x157 [bluetooth]
 [] l2cap_recv_frame+0xa77/0xfa4 [bluetooth]
 [] ? trace_hardirqs_on_caller+0x112/0x1ad
 [] l2cap_recv_acldata+0xe2/0x264 [bluetooth]
 [] hci_rx_work+0x235/0x33c [bluetooth]
 [] ? process_one_work+0x126/0x2fe
 [] process_one_work+0x185/0x2fe
 [] ? process_one_work+0x126/0x2fe
 [] ? lock_acquired+0x1b5/0x1cf
 [] ? le_scan_work+0x11d/0x11d [bluetooth]
 [] ? spin_lock_irq+0x9/0xb
 [] worker_thread+0xcf/0x175
 [] ? rescuer_thread+0x175/0x175
 [] kthread+0x95/0x9d
 [] kernel_threadi_helper+0x4/0x10
 [] ? retint_restore_args+0x13/0x13
 [] ? flush_kthread_worker+0xdb/0xdb
 [] ? gs_change+0x13/0x13

This bug can be reproduced using hctool lecc or l2test tools and
bluetoothd not running.

Signed-off-by: Andre Guedes 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: mgmt: Fix enabling LE while powered off

2012-10-02T17:30:08+00:00

commit 562fcc246ebe31ade6e1be08585673b9b2785498 upstream.

When new BT USB adapter is plugged in it's configured while still being powered
off (HCI_AUTO_OFF flag is set), thus Set LE will only set dev_flags but won't
write changes to controller. As a result it's not possible to start device
discovery session on LE controller as it uses interleaved discovery which
requires LE Supported Host flag in extended features.

This patch ensures HCI Write LE Host Supported is sent when Set Powered is
called to power on controller and clear HCI_AUTO_OFF flag.

Signed-off-by: Andrzej Kaczmarek 
Acked-by: Johan Hedberg 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix not removing power_off delayed work

2012-10-02T17:30:08+00:00

commit 78c04c0bf52360dc2f7185e99c8e9aa05d73ae5a upstream.

For example, when a usb reset is received (I could reproduce it
running something very similar to this[1] in a loop) it could be
that the device is unregistered while the power_off delayed work
is still scheduled to run.

Backtrace:

WARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d()
Hardware name: To Be Filled By O.E.M.
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x26
Modules linked in: nouveau mxm_wmi btusb wmi bluetooth ttm coretemp drm_kms_helper
Pid: 2114, comm: usb-reset Not tainted 3.5.0bt-next #2
Call Trace:
 [] ? free_obj_work+0x57/0x91
 [] warn_slowpath_common+0x7e/0x97
 [] warn_slowpath_fmt+0x41/0x43
 [] debug_print_object+0x7c/0x8d
 [] ? __queue_work+0x259/0x259
 [] ? debug_check_no_obj_freed+0x6f/0x1b5
 [] debug_check_no_obj_freed+0x98/0x1b5
 [] ? bt_host_release+0x10/0x1e [bluetooth]
 [] kfree+0x90/0xe6
 [] bt_host_release+0x10/0x1e [bluetooth]
 [] device_release+0x4a/0x7e
 [] kobject_release+0x11d/0x154
 [] kobject_put+0x4a/0x4f
 [] put_device+0x12/0x14
 [] hci_free_dev+0x22/0x26 [bluetooth]
 [] btusb_disconnect+0x96/0x9f [btusb]
 [] usb_unbind_interface+0x57/0x106
 [] __device_release_driver+0x83/0xd6
 [] device_release_driver+0x20/0x2d
 [] usb_driver_release_interface+0x44/0x7b
 [] usb_forced_unbind_intf+0x45/0x4e
 [] usb_reset_device+0xa6/0x12e
 [] usbdev_do_ioctl+0x319/0xe20
 [] ? avc_has_perm_flags+0xc9/0x12e
 [] ? avc_has_perm_flags+0x25/0x12e
 [] ? do_page_fault+0x31e/0x3a1
 [] usbdev_ioctl+0x9/0xd
 [] vfs_ioctl+0x21/0x34
 [] do_vfs_ioctl+0x408/0x44b
 [] ? file_has_perm+0x76/0x81
 [] sys_ioctl+0x51/0x76
 [] system_call_fastpath+0x16/0x1b

[1] http://cpansearch.perl.org/src/DPAVLIN/Biblio-RFID-0.03/examples/usbreset.c

Signed-off-by: Vinicius Costa Gomes 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: mgmt: Fix enabling SSP while powered off

2012-10-02T17:30:08+00:00

commit 3d1cbdd6aefff711bcf389fdabc4af9bc22e8201 upstream.

When new BT USB adapter is plugged in it's configured while still being powered
off (HCI_AUTO_OFF flag is set), thus Set SSP will only set dev_flags but won't
write changes to controller. As a result remote devices won't use Secure Simple
Pairing with our device due to SSP Host Support flag disabled in extended
features and may also reject SSP attempt from our side (with possible fallback
to legacy pairing).

This patch ensures HCI Write Simple Pairing Mode is sent when Set Powered is
called to power on controller and clear HCI_AUTO_OFF flag.

Signed-off-by: Andrzej Kaczmarek 
Acked-by: Johan Hedberg 
Signed-off-by: Gustavo Padovan 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: L2CAP - Fix info leak via getsockname()

2012-10-02T17:29:36+00:00

[ Upstream commit 792039c73cf176c8e39a6e8beef2c94ff46522ed ]

The L2CAP code fails to initialize the l2_bdaddr_type member of struct
sockaddr_l2 and the padding byte added for alignment. It that for leaks
two bytes kernel stack via the getsockname() syscall. Add an explicit
memset(0) before filling the structure to avoid the info leak.

Signed-off-by: Mathias Krause 
Cc: Marcel Holtmann 
Cc: Gustavo Padovan 
Cc: Johan Hedberg 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: RFCOMM - Fix info leak via getsockname()

2012-10-02T17:29:36+00:00

[ Upstream commit 9344a972961d1a6d2c04d9008b13617bcb6ec2ef ]

The RFCOMM code fails to initialize the trailing padding byte of struct
sockaddr_rc added for alignment. It that for leaks one byte kernel stack
via the getsockname() syscall. Add an explicit memset(0) before filling
the structure to avoid the info leak.

Signed-off-by: Mathias Krause 
Cc: Marcel Holtmann 
Cc: Gustavo Padovan 
Cc: Johan Hedberg 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman